Predicate abstraction and canonical abstraction for singly-linked lists

Predicate Abstraction and Canonical Abstractionfor Singly-Linked ListsTel Aviv University,School of Computer Science,TR-2005-01-191212R.Manevich1,⋆,E.Yahav2,G.Ramalingam2,and M.Sagiv11Tel Aviv University,{rumster,msagiv}@tau.ac.il2IBM T.J.Watson Research Center,{rama,eyahav}@Abstract.Predicate abstraction and canonical abstraction are twofinitary ab-stractions used to prove properties of programs.We study the relationship be-tween these two abstractions by considering a very limited case:abstraction of(potentially cyclic)singly-linked lists.We provide a new and rather precise family of abstractions for potentially cyclicsingly-linked lists.The main observation behind this family of abstractions is thatthe number of shared nodes in linked lists can be statically bounded.Therefore,the number of possible“heap shapes”is also bounded.We present the new ab-straction in both predicate abstraction form as well as in canonical abstractionform.As we illustrate in the paper,given any canonical abstraction,it is possible to de-fine a predicate abstraction that is equivalent to the canonical abstraction.How-ever,with this straightforward simulation,the number of predicates used forthe predicate abstraction is exponential in the number of predicates used by thecanonical abstraction.An important feature of the family of abstractions we present in this paper isthat the predicate abstraction representation we define is far more practical as ituses a number of predicates that is quadratic in the number of predicates used bythe corresponding canonical abstraction representation.In particular,for the mostabstract abstraction in this family,the number of predicates used by the canonicalabstraction is linear in the number of program variables,while the number ofpredicates used by the predicate abstraction is quadratic in the number of programvariables.We have encoded this particular predicate abstraction and corresponding trans-formers in TVLA,and used this implementation to successfully verify safetyproperties of several list manipulating programs,including programs that werenot previously verified using predicate abstraction or canonical abstraction.1IntroductionAbstraction and abstract interpretation[7]are essential techniques for automatically proving properties of programs.The main challenge in abstract interpretation is to de-velop abstractions that are precise enough to prove the required property and efficient enough to be applicable to realistic applications.⋆This research was supported by THE ISRAEL SCIENCE FOUNDATION(grant No304/03).Predicate abstraction[11]abstracts the program into a Boolean program which con-servatively simulates all potential executions.Every safety property which holds for the Boolean program is guaranteed to hold for the original program.Furthermore,abstrac-tion refinement[6,2]can be used to refine the abstraction when the analysis produces a “false alarm”.When the process terminates,it yields a concrete error trace in which the property is violated,or successfully verifies the property.In principle,the whole process can be fully mechanized given a sufficiently powerful theorem prover.This process was successfully used in SLAM[19]and BLAST[12]to prove safety properties of device drivers.Canonical abstraction[23]is afinitary abstraction that was specially developed to model properties of unbounded memory locations(inspired by[16]).This abstraction has been implemented in TVLA[17],and successfully used to prove various properties of heap-manipulating programs(e.g.,[21,25,24]).1.1Main ResultsIn this paper,we study the utility of predicate abstraction to prove properties of pro-grams operating on singly-linked lists.We also compare the expressive power of predi-cate abstraction and canonical abstraction.The results in this paper can be summarized as follows:–We show that current state-of-the-art iterative refinement techniques fail to prove interesting properties of singly-linked lists such as pointer equalities and absence of null dereferences in a fully automatic manner.This means that on many simple programs the process of refinement will diverge when the program is correct.This result is inline with the experience of Blanchet et al.[4].–We show that predicate abstraction can simulate arbitraryfinitary abstractions and, in particular,canonical abstraction.This trivial result is not immediately useful because of the number of predicates used.The number of predicates required to simulate canonical abstraction is,in the worst case,exponential in the number of predicates used by the canonical abstraction(usually,this means exponential in the number of program variables).–We develop a new family of abstractions for heaps containing(potentially cyclic) singly-linked lists.The main idea is to summarize list elements on unshared list seg-ments not pointed-to by local variables.For programs manipulating singly-linked lists,this abstraction isfinitary since the number of shared list elements reachable from program variables is bounded.Abstractions in this family vary in their level of precision,which is controlled by the level of sharing-relationships recorded.–We show that the abstraction recording only one-level sharing relationships(i.e., the least precise member of the family that records sharing)is sufficient for suc-cessfully verifying all our example programs,including programs that were not verified earlier using predicate abstraction or canonical abstraction.–We show how to code the one-level-sharing abstraction using both canonical ab-straction(with a linear number of unary predicates)and predicate abstraction(witha quadratic number of nullary predicates).//head points to the first element of an acyclic list//tail points to the last element of the same list1curr=head;2while(curr!=tail){3assert(curr!=null);4curr=curr.n;5}Fig.1.A simple program on which counterexample-guided refinement diverges1.2Motivating ExamplesFig.1shows a program that traverses a singly-linked list with a head-pointer head and a tail-pointer tail.This is a trivial program since it only uses an acyclic linked list, and does not contain destructive pointer updates.When counterexample-guided itera-tive refinement is applied to this program to assure that the assertion at line3is never violated,it will diverge.At the i-th iteration it will generate an assertion of the form curr(.n)i!=null.However,nofinite value of i will suffice.Indeed,the problem of proving the absence of null-dereferences is undecidable even in programs manipulating singly-linked lists and even under the(non-realistic)assumption that all controlflow paths are executable[5].In contrast,the TVLA abstract interpreter[17]proves the absence of null dererefer-ences in this program in2seconds,consuming0.6MB of LA uses canon-ical abstraction which generalizes predicate abstraction by allowingfirst-order pred-icates(relation symbols)that can have arguments.Thus,nullary(0-arity)predicates correspond to predicates in the program and in predicate abstractions.Unary predicates (1-arity)are used to denote sets of unbounded locations and binary(2-arity)predicates are used to denote relationships between unbounded locations.A curious reader may ask herself:Are there program properties that can be verified with canonical abstractions but not with predicate abstractions?It is not hard to see that the answer is negative,since anyfinitary abstraction can be simulated by a suitable predicate abstraction.For example,consider an abstraction mappingα:C→A,from a concrete domain C to afinite abstract domain of indexed elements A={1,...,n}.Define the predicate BIT[j]to hold for the set of concrete states{c|the j th bit ofα(c),in its binary representation,is1}.Now,the set of predi-cates{BIT[j]}⌈log n⌉j=1yields a predicate abstraction that simulates A.This simulation isusually not realistic,since it contains too many predicates.The number of predicates required by predicate abstraction to simulate canonical abstraction can be exponential in the number of predicates used by the canonical abstraction.Fortunately,the only nullary predicate crucial to prove the absence of null deref-erences in this program is the fact that tail is reachable from curr by a path of n selectors(of some length).Similar observations were suggested independently in[15, 3,14].In this paper,we define a quadratic set of nullary predicates that captures the invariants in many programs manipulating(potentially cyclic)singly-linked lists.Fig.2shows a simple program removing a contiguous segment from a cyclic singly-linked list pointed-to by x.For this example program,we would like to verify that the resulting structure pointed-to by x remains a cyclic singly-linked list.Unfortunately, using TVLA’s canonical abstraction with the standard set of predicates turns out to//x points to a cyclic singly-linked list//low and high are two integer values,low<high1t=null;2y=x;3while(t!=x&&y.data<low){4t=y.n;y=t;5}6z=y;7while(z!=x&&z.data<high){8t=z.n;z=t;9}10t=null;11if(y!=z){12y.n=null;13y.n=z;14}Fig.2.A simple program that removes the segment between low and high from a linked list be insufficient.The problem stems from the fact that canonical abstraction with the standard set of predicates loses the ordering between the3reference variables that point to that cyclic singly-linked list(this is further explained in the next section).In this paper,we provide two abstractions—a predicate abstraction,and a canonical abstraction—that are able to correctly determine that the result of this program is indeed a cyclic singly-linked list.The rest of this paper is organized as follows:Sec.2provides background on the basic concrete semantics we are using,canonical abstraction,and predicate abstraction. Sec.3presents an instrumented concrete semantics that records list interruptions.Sec.4 shows a quite precise predicate abstraction for singly-linked lists.Sec.5shows a quite precise canonical abstraction of singly-linked lists.In Sec.6,we show that the predicate abstraction of Sec.4and the canonical abstraction of Sec.5are equivalent.Sec.7 describes our experimental results.Proofs of claims and additional technical details can be found in the respective appendices.2BackgroundIn this section,we provide basic definitions that we will use throughout the paper.In particular,we define canonical abstraction and predicate abstraction.2.1Concrete Program StatesWe represent the state of a program using afirst-order logical structure in which each individual corresponds to a heap-allocated object and predicates of the structure corre-spond to properties of heap-allocated objects.Definition1.A2-valued logical structure over a vocabulary(set of predicates)P is a pair S= U,ι where U is the universe of the2-valued structure,andιis the in-terpretation function mapping predicates to their truth-value in the structure:for every predicate p∈P of arity k,ι(p):U k→{0,1}.We denote the set of all2-valued logical structures over a set of predicates P by 2-STRUCT P.In the sequel,we assume that the vocabulary P isfixed,and abbreviate 2-STRUCT P to2-STRUCT.Table1.Predicates used for representing concrete program statesPredicates Intended Meaningeq(v1,v2)v1is equal to v2{x(v):x∈PVar}reference variable x points to the object vn(v1,v2)nextfield of the object v1points to the object v2 Table1shows the predicates we use to record properties of individuals.A unary predicate x(v)holds when the object v is pointed-to by the reference variable x.We assume that the set of predicates includes a unary predicate for every reference variable in a program.We use PVar to denote the set of all reference variables in a program.A binary predicate n(v1,v2)records the value of the referencefield n.z/.-,()*+n/.-,()*+nx/.-,()*+n /.-,()*+ n/.-,()*+n/.-,()*+n/.-,()*+nyz/.-,()*+n/.-,()*+nx/.-,()*+n/.-,()*+n/.-,()*+y (a)(b)Fig.3.The effect of the statement y.n=null in the concrete semantics.(a)a possible state of the program of Fig.2at line12;(b)the result of applying y.n=null to(a)Concrete Semantics Program statements are modelled by actions that specify how statements transform an incoming logical structure into an outgoing logical structure. This is done primarily by defining the values of the predicates in the outgoing struc-ture using formulae offirst-order logic with transitive closure over the incoming struc-ture[23].The update formulae for heap-manipulating statements are shown in Table2. For brevity,we omit the treatment of the allocation statement new T(),the interested reader mayfind the details in[23].To simplify update formulae,we assume that every assignment to the nfield of an object is preceded byfirst assigning null to it.Therefore,the statement at line12of the example program of Fig.2assigns null to y.n before the next statement assigns it the new value z.Example1.Applying the action y.n=null to the concrete structure of Fig.3(a), results with the concrete structure of Fig.3(b).Throughout this paper we assume that all heaps are garbage-free,i.e.,every element is reachable from some program variable, and that the concrete program semantics reclaims garbage elements immediately afterTable2.Predicate-update formulae that define the semantics of heap-manipulating statements Statement Update formulaex=null x′(v)=0x=t x′(v)=t(v)x=t.n x′(v)=∃v1:t(v1)∧n(v1,v)x.n=null n′(v1,v2)=n(v1,v2)∧¬x(v1)x.n=t(assuming x.n==null)n′(v1,v2)=n(v1,v2)∨(x(v1)∧t(v2)) executing program statements.Thus,the two objects between y and z are collected when y.n is set to null,as they become unreachable.2.2Canonical AbstractionThe goal of an abstraction is to create afinite representation of a potentially unbounded set of2-valued structures(representing heaps)of potentially unbounded size.The ab-stractions we use are based on3-valued logic[23],which extends boolean logic by introducing a third value1/2denoting values that may be0or1.We represent an abstract state of a program using a3-valuedfirst-order structure. Definition2.A3-valued logical structure over a set of predicates P is a pair S= U,ι where U is the universe of the3-valued structure(an individual in U may rep-resent multiple heap-allocated objects),andιis the interpretation function mapping predicates to their truth-value in the structure:for every predicate p∈P of arity k,ι(p):U k→{0,1,1/2}.An abstract state may include summary nodes,i.e.,an individual which corresponds to one or more individuals in a concrete state represented by that abstract state.A summary node u has eq(u,u)=1/2,indicating that it may represent more than a single individual.Embedding We now formally define how states are represented using abstract states. The idea is that each individual from the(concrete)state is mapped into an individual in the abstract state.More generally,it is possible to map individuals from an abstract state into an individual in another,less precise,abstract state.Formally,let S= U,ι and S′= U′,ι′ be abstract states.A function f:U→U′such that f is surjective is said to embed S into S′if for each predicate p of arity k,and for each u1,...,u k∈U,one of the following holds:ι(p(u1,...,u k))=ι′(p(f(u1),...,f(u k)))orι′(p(f(u1),...,f(u k)))=1/2 We say that S′represents S when there exists such an embedding f.One way of creating an embedding function f is by using canonical abstraction. Canonical abstraction maps concrete individuals to an abstract individual based on the values of the individuals’unary predicates.All individuals having the same values for unary predicate symbols are mapped by f to the same abstract individual.Table3.Predicates used for the canonical abstraction in Fig.4,and their meaning.The notation n∗stands for the reflexive-transitive closure of the predicate n,and n+stands for the transitive closure of nPredicates Intended Meaning Defining formulae{x(v):x∈PVar}reference variable x points to vn(u,v)nextfield of u points to v{r x(v):x∈PVar}v is reachable from x by∃v x.x(v x)∧n∗(v x,v)dereferencing nfieldsc n(v)v resides on a cycle of nfields n+(v,v)is(v)v is heap-shared∃v1,v2.n(v1,v)∧n(v2,v)∧(v1=v2)z/.-,()*+n/.-,()*+nx/.-,()*+ n /.-,()*+ n/.-,()*+n/.-,()*+n/.-,()*+nyz,c n,r z,r x,r yx,c n,r x,r y,r z/.-,()*+n/.-,()*+n/.-,()*+nnnnc n,r x,r y,r zF F Fy,c n,r y,r x,r z/.-,()*+nNotNull[x]NotNull[y]NotNull[z]EqualsNext2[x,y]EqualsNext3[y,z]EqualsNext2[z,x]...(a)(b)(c)Fig.4.(a)a concrete possible state of the program of Fig.2at line12,(b)its canonical abstraction in TVLA,(c)its predicate abstraction with the set of predicates in Table4Table3presents the set of predicates used in[23]to abstract singly-linked lists.The predicates r x(v),c n(v),and is(v),referred to in[23]as instrumentation predicates, record derived information and are used to refine the abstraction.This set of predicates has been used for successfully verifying many programs ma-nipulating singly-linked lists,but is insufficient for verifying that the output of the ex-ample program of Fig.2is a cyclic singly-linked list pointed-to by x.Example2.Fig.4(b)shows the canonical abstraction of the concrete state of Fig.4(a), using the predicates of Table3.The node with double-line boundaries is a summary node,possibly representing more than a single concrete node.The dashed edges are 1/2edges,a dashed edge exists between v1and v2when n(v1,v2)=1/2.The abstract state of Fig.4(b)records the fact that x,y,and z point to a cyclic list(using the c n(v) predicate),and that all list elements are reachable from all3reference variables(using the r x(v),r y(v),and r z(v)predicates).This abstract state,however,does not record the order between the reference variables.In particular,it does not record that x does not reside between y and z(the segment that is about to be removed by the program statement at line12).As a result,applying the abstract effect of y.n=z to this abstract state results with a possible abstract state in which the cyclic list is broken.2.3Predicate AbstractionPredicate abstraction abstracts a concrete state into a truth-assignment for afinite set of propositional(nullary)predicates.A predicate abstraction is defined by a vocabulary P A={P1,...,P m},where each P i is associated with a defining formulaϕi that can be evaluated over concrete states.An abstract state is a truth assignment to the predicates in P A.Given an abstract state A,we denote the value of P i in A by A i.A concrete state S over a vocabulary P C,is mapped to an abstract state A by an abstraction mappingβ:2-STRUCT[P C]→2-STRUCT[P A].The abstraction mapping evaluates the defining formulae of the predicates in P A over S and sets the appropriate values to the respective predicates in A.Formally,for every1≤i≤m,A i=[[ϕi]]S2. Table4.Predicates used for the predicate abstraction in Fig.4,and their meaning.Note that the maximal tracked length K isfixed a prioriPredicates Intended meaning Defining formulae{NotNull[x]:x∈PVar}x is not null∃v x.x(v x){EqualsNext k[x,y]the node pointed-to by y∃v0,...,v k.x(v0)∧y(v k)∧:x,y∈PVar,is reachable by k nfields V0≤i<k n(v i,v i+1)0≤k≤K}from the node pointed-to by xTable4shows an example set of predicates similar to the ones used in[1,8]. Example3.Fig.4(c)shows the predicate abstraction of the concrete state shown in Fig.4(a)using the predicates of Table4.A predicate of the form NotNull[x]records the fact that x is not null.In Fig.4(c),all three variables x,y,and z are not null.A predicate of the form EqualsNext k[x,y]records that the node pointed-to by y is reachable by k steps over the nfields from the node pointed-to by x(Note that K,the maximal tracked length,isfixed a priori).For example,in Fig.4(c),the list element pointed-to by y is reachable from the list element pointed-to by x in2steps over the nfield,and therefore EqualsNext2[x,y]holds.3Recording List InterruptionsIn this section,we instrument the concrete semantics to record a designated set of nodes, called interruptions,in singly-linked lists.The instrumented concrete semantics pre-sented in this section serves as the basis for the predicate abstraction and the canonical abstraction presented in the following sections.3.1The IntuitionThe intuition behind our instrumented concrete is that a garbage-free heap,containing only singly-linked lists,is characterized by two factors:(i)the“shape”of the heap, i.e.,the connectivity relations between a set of designated nodes(interruptions);and (ii)the length of“simple”list segments connecting interruptions,but not containing interruptions themselves.This intuition is similar to proofs of small model properties.Considering this characterization,we observe that the number of shapes that are equivalent,up to lengths of simple list segments,is bounded.We therefore instrument our concrete semantics to record interruptions,which are an essential ingredient of the sharing patterns.The abstractions presented in the next sections,abstract the lengths of simple list segments into a fixed set of abstract lengths (thereby obtaining a finite representation).These abstractions retain the general shape of the heap but lose any correlations between the actual lengths of different simple list segments.Our experience indicates that the correctness of program properties usually depends on the shape of heap,rather than on the lengths of simple list segments.In the rest of this section,we formally define the notions of interruptions and sim-ple list segments,and formally define the information recorded by our instrumented concrete semantics.3.2Basic DefinitionsWe say that a list node v is an interrupting node ,or simply an interruption ,if it is pointed-to by a program variable or it is heap-shared.Fig.5shows a heap with 4in-terruptions:(i)the node pointed-to by x ,(ii)the node pointed-to by y ,(iii)the node pointed-to by x s,1and y s,1,and (iv)the node pointed-to by x s,2and y s,2.Definition 3(Uninterrupted Lists).We say that there is an uninterrupted list between list node u and list node v ,denoted by UList (u,v ),when there is a non-empty path between them,such that,every node on the path between them (i.e.,not including u and v )is non-interrupting.We also say that there is an uninterrupted list between list node v and null,denoted by UListNULL (v ),when there is a non-empty path from v to null,such that,every node on the path,except possibly v ,is non-interrupting.Table 5formulates UList (u,v )and UListNULL (v )as formulae in F O T C .Given a heap,we are actually interested in a subset of its uninterrupted lists.We say that an uninterrupted list is maximal when it is not contained in a longer uninterrupted list.The heap in Fig.5contains 4maximal uninterrupted lists:(i)from the node pointed-to by x and the node pointed-to by x s,1and y s,1,(ii)from the node pointed-to by y and the node pointed-to by x s,1and y s,1,(iii)from the node pointed-to by x s,1and y s,1to the node pointed-to by x s,2and y s,2,and (iv)from the node pointed-to by x s,2and y s,2to itself.y /.-,()*+n Q Q Q Q Q Q Q Q x /.-,()*+n /.-,()*+n /.-,()*+n .-,n /.-,()*+n /.-,()*+EC D @G F n x s,1,y s,1x s,2,y s,2Fig.5.Two lists sharing the same tail,and their representation in the instrumented concrete se-manticsTable5.Shorthand notations used throughout this paperShorthand Meaning FormulaHeapShared(v)v is heap-shared∃a,b.n(a,v)∧n(b,v)∧(a=b) PtByVar(v)v is pointed-to by some variable W var∈PVar var(v)Interruption(v)v is an interrupting list node HeapShared(v)∨PtByVar(v)UList1(u,v)there is an uninterrupted list of n(u,v)length1from u to vUList2(u,v)there is an uninterrupted∃m.¬Interruption(m)∧list of length2from u to v n(u,m)∧n(m,v)UList>2(u,v)there is an uninterrupted∃m1,m2:n(u,m1)∧n(m2,v)∧list of length>2from u to v(TC a,b:n(a,b)∧¬Interruption(a)∧¬Interruption(b))(m1,m2)UList(u,v)there is an uninterrupted list of UList1(u,v)∨UList2(u,v)∨some length from u to v UList>2(u,v)UListNULL1(v)there is an uninterrupted list of∀w.¬n(v,w)length1from v to nullUListNULL2(v)there is an uninterrupted∃m.n(v,m)∧¬Interruption(m)∧list of length2from v to null UListNULL1(m)UListNULL>2(v)there is an uninterrupted∃m1,m2:n(v,m1)∧UListNULL1(m2) list of length>2from v(TC a,b:n(a,b)∧¬Interruption(a)∧to null¬Interruption(b))(m1,m2) UListNULL(v)there is a list of some length UListNULL1(v)∨UListNULL2(v)∨from v to null UListNULL>2(v)3.3Statically Naming Heap-Shared NodesWe now explain how to use a quadratic number of auxiliary variables to statically name all heap-shared nodes.This will allow us to name all maximal uninterrupted lists us-ing nullary predicates for the predicate abstraction,and using unary predicates for the canonical abstraction.Proposition1.A garbage-free heap,consisting of only singly-linked lists with n pro-gram variables,contains at most n heap-shared nodes and at most2n interruptions.Proof.See Appendix B.Corollary1.In a garbage-free heap,consisting of only singly-linked lists with n pro-gram variables,list node v is reachable from list node u if and only if it is reachable by a sequence of k<n uninterrupted lists.Similarly,there is a path from node v to null if and only if there is a path from v to null by a sequence of k<n uninterrupted lists.Proof.By Proposition1,every simple path(from u to v or from v to null)contains at most n interruptions,and,therefore,at most n maximal uninterrupted lists.⊓⊔For every program variable x,we define a set of auxiliary variables{x s,k|k= 1...n−1}.Auxiliary variable x s,k points to a heap-shared node u when there exists asimple path consisting of k maximal uninterrupted lists from the node pointed by x-to to u,such that all of the interrupting nodes on the path are not pointed-to by program variables(i.e.,they are heap-shared).Formally,we define the set of auxiliary variables derived for program variable x by using the following set of formulae in F O T C.x s,1(v)≡∃v x.x(v x)∧UList(v x,v)∧HeapShared(v)∧¬PtByVar(v),...x s,k+1(v)≡∃v k.x s,k(v k)∧UList(v k,v)∧HeapShared(v)∧¬PtByVar(v)∧¬( m=1...k x s,m(v)).We denote the set of auxiliary variables by AuxVar and the set of all(program and auxiliary)variables by Var=PVar∪AuxVar.Proposition2.Every heap-shared node is pointed-to by a variable in Var.Also,x s,k(v) holds for at most one node,for every reference variable x and every index k.Proof.See Appendix B.3.4Parameterizing the Concrete SemanticsLet n denote the number of(regular)program variables.Notice that|AuxV ar|= O(n2).In the following sections,we will see that using the full set of auxiliary variables yields a canonical abstraction with a quadratic(O(n2))number of unary predicates,and a predicate abstraction with a bi-quadratic(O(n4))number of predicates.We use a parameter k to define different subsets of Var as follows:Var k=PVar∪{x s,i(v)|x∈PVar,i≤k}.By varying the“heap-shared depth”parameter k,we are able to distinguish between different sets of heap-shared nodes.We discovered that, in practice,heap-shared nodes with depth>1rarely exist(they never appear in our examples),and,therefore,restricting k to1is usually enough to capture all maximal uninterrupted ing Var1as the set of variables to record,we obtain a canonical abstraction with a linear number of unary predicates(O(n))and a predicate abstraction with a quadratic(O(n2))number of variables.Fig.5shows a heap containing a heap-shared node of depth2(pointed by x s,2and y s,2).By setting the heap-shared depth parameter k to1,we are able to record the following facts about this heap:(i)there is a list of length1from the node pointed-to by x to a heap-shared node,(ii)there is a list of length1from the node pointed-to by y to a heap-shared node,(iii)the heap-shared node mentioned in(i)and(ii)is the same(we record aliasing between variables),and(iv)there is a partially cyclic list(i.e.,a non-cyclic list connected to a cyclic list)from the heap-shared node mentioned in(iii).We know that the list from thefirst heap-shared node does not reach null(since we record lists from interruptions to null)and it is not a cycle from thefirst-heap shared node to itself(otherwise there would be no second heap-shared node and the cycle would be recorded).The information lost,due to the fact that x s,2and y s,2are not recorded,is that the list from thefirst heap-shared node to second has length2and the cycle from the second heap-shard node to itself is also of length2.。